How to Monitor NeuVector with Vigilmon

NeuVector is an open-source, full lifecycle container security platform that provides deep network inspection, zero-trust security policy enforcement, and runtime vulnerability scanning for Kubernetes workloads. Because it sits inline on your data path, NeuVector's health directly affects the security posture of your entire cluster.

In this tutorial you'll set up external uptime monitoring for NeuVector using Vigilmon — free tier, no credit card required.

Why NeuVector needs external monitoring

NeuVector runs as a set of DaemonSet pods and a central Manager/Controller deployment. When any component goes unhealthy, the consequences are serious:

• Silent protection gaps — if an Enforcer DaemonSet pod crashes on a node, containers on that node lose inline inspection without triggering a visible user-facing error
• Policy sync failures — if the Controller pod restarts, new workloads may start with no security policy attached
• Manager UI unavailability — security teams lose visibility into active connections, violations, and threats
• Admission controller failures — NeuVector's Kubernetes admission webhook can block pod scheduling if it becomes unresponsive, causing cascading deployment failures

Kubernetes liveness probes only check whether individual pods are alive. They cannot tell you whether the NeuVector API is accepting requests, whether the Manager dashboard is reachable from your security team's browser, or whether the admission webhook is correctly wired up. External monitoring covers all of these.

What you'll need

• A Kubernetes cluster running NeuVector (installed via Helm or the NeuVector operator)
• The NeuVector Manager exposed via LoadBalancer or Ingress
• A free Vigilmon account

Step 1: Verify NeuVector is exposed and healthy

After installing NeuVector, check that its Manager service is reachable:

# Check all NeuVector pods
kubectl get pods -n neuvector

# Expected output — all pods should be Running
# NAME                                READY   STATUS    RESTARTS   AGE
# neuvector-controller-pod-xxx        1/1     Running   0          10m
# neuvector-enforcer-pod-xxx          1/1     Running   0          10m
# neuvector-manager-pod-xxx           1/1     Running   0          10m
# neuvector-scanner-pod-xxx           1/1     Running   0          10m

# Check the Manager service external IP
kubectl get svc -n neuvector neuvector-service-webui
# NAME                        TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)          AGE
# neuvector-service-webui     LoadBalancer   10.96.10.50     203.0.113.80    8443:30443/TCP   10m

The NeuVector Manager listens on port 8443 (HTTPS) by default. Verify it responds:

curl -k https://203.0.113.80:8443/
# Should return HTML or a redirect — HTTP 200 or 302 is a good sign

NeuVector also exposes a REST API at /auth and /v1/. You can probe this endpoint for a clean health check:

curl -k -s -o /dev/null -w "%{http_code}" \
  https://203.0.113.80:8443/v1/auth \
  -H "Content-Type: application/json" \
  -d '{"password":{"username":"","password":""}}'
# Returns 401 (unauthorized) — but the server is responding, which is all we need

A 401 response from /v1/auth proves the REST API is alive. Use this as your health probe URL.

Step 2: Set up HTTP monitoring in Vigilmon

1. Log in to vigilmon.online and go to Monitors → New Monitor
2. Choose HTTP / HTTPS as the type
3. Enter the NeuVector Manager URL: https://203.0.113.80:8443/v1/auth (or your Ingress hostname)
4. Set the check interval to 1 minute
5. Under Expected response, set Status code to 401 (this is the correct response for the unauthenticated auth endpoint)
6. Save the monitor

Accepting 401 as healthy is intentional: it means the API server is running and processing requests — it's just correctly rejecting unauthenticated calls. This is a standard technique for monitoring authenticated APIs without storing credentials in your monitoring system.

If you have a custom health endpoint or a load balancer that returns 200 for the root path, use that instead.

Multi-region validation

Vigilmon checks from multiple geographic regions simultaneously. For a security tool like NeuVector this is especially useful: you want to know if the Manager is unreachable from your remote security team's location, not just from within the cluster's network. Multi-region consensus ensures you get alerted for real outages without noise from single-region network blips.

Step 3: Monitor NeuVector's REST API TCP port

Add a TCP monitor to detect when the port binding itself fails — a condition that can happen when the Manager pod restarts or when a service mesh interferes with the listener:

1. Go to Monitors → New Monitor
2. Choose TCP Port
3. Host: your NeuVector Manager IP or hostname
4. Port: 8443
5. Save the monitor

The TCP check is complementary to the HTTP check: TCP failure means the socket isn't even accepting connections, while HTTP failure means the application layer has a problem.

Step 4: Monitor NeuVector Controllers

The NeuVector Controller is the brain of the platform — it holds security policy state and syncs it to Enforcers. You can monitor its internal REST API (used by the Manager) via port 10443:

# Check the Controller service
kubectl get svc -n neuvector neuvector-svc-controller

# If exposed via NodePort, get the node IP and port
kubectl get svc -n neuvector neuvector-svc-controller -o jsonpath='{.spec.ports[0].nodePort}'

Add a TCP monitor for the Controller port. If the Controller stops responding, security policy sync halts across the cluster even if the Manager UI appears healthy.

Step 5: Configure alert channels

Security tools require fast alerting. A NeuVector outage is a silent vulnerability window.

Email alerts

1. Go to Alert Channels → Add Channel → Email
2. Add your security team's email (or on-call address)
3. Assign to all NeuVector monitors

Webhook alerts (Slack, PagerDuty, Opsgenie)

1. Go to Alert Channels → Add Channel → Webhook
2. Enter your webhook URL

Example Vigilmon alert payload:

{
  "monitor_name": "NeuVector Manager API",
  "status": "down",
  "url": "https://203.0.113.80:8443/v1/auth",
  "started_at": "2024-01-15T10:23:00Z",
  "duration_seconds": 90
}

When you receive this alert, your immediate runbook should be:

# 1. Check NeuVector pod health
kubectl get pods -n neuvector

# 2. Check Controller logs for policy sync issues
kubectl logs -n neuvector -l app=neuvector-controller-pod --tail=50

# 3. Check Manager logs
kubectl logs -n neuvector -l app=neuvector-manager-pod --tail=50

# 4. Check for admission webhook issues that could block deployments
kubectl get validatingwebhookconfigurations | grep neuvector
kubectl describe validatingwebhookconfiguration neuvector-validating-admission-webhook

Step 6: Create a status page for your security team

NeuVector downtime affects multiple teams: DevOps, Security, and Compliance all rely on it. A status page gives everyone visibility without requiring kubectl access:

1. Go to Status Pages → New Status Page
2. Name it: "Cluster Security Platform"
3. Add your NeuVector monitors: Manager API, Controller TCP
4. Publish the page

Share the URL in your team's security channel and incident runbook.

Monitor summary

| Monitor | Type | What it catches | |---------|------|-----------------| | https://neuvector-mgr:8443/v1/auth | HTTP (expect 401) | Manager API availability, TLS issues, app crashes | | neuvector-mgr:8443 | TCP | Port binding failure, load balancer routing issues | | neuvector-controller:10443 | TCP | Controller availability, policy sync failures |

What's next

• Heartbeat monitoring — if you run NeuVector scanner jobs on a schedule, add Vigilmon heartbeat monitors to alert when scans stop running
• SSL certificate expiry — NeuVector uses self-signed or custom TLS; monitor cert expiry to avoid sudden HTTPS failures
• Multi-environment coverage — run separate monitors for dev, staging, and production NeuVector deployments so a staging misconfiguration doesn't go unnoticed

Get started free at vigilmon.online — no credit card, monitors start running in under a minute.